Minor Description
The current option struts.disallowProxyMemberAccess does not have any logic to detect Hibernate proxies which may also present a security risk.
Additionally, the current option only forbids access to members which originate from a proxy. However, it makes more sense to forbid access to proxy objects entirely. This is because proxying is often used for sensitive instances, application beans or Hibernate objects. None of which is safe to be accessed or manipulated via OGNL. Thus, let's introduce an additional option struts.disallowProxyObjectAccess which will offer stronger protection.
Finally, the caching mechanism in the ProxyUtil class uses an unbounded map, this can potentially be attacked and lead to a memory leak or DoS. Let's replace it with a Caffeine cache as we have done previously for the OGNL expression cache.
